Threats Tagged 'exploited-in-the-wild'

CVE-2021-27878 is a command execution vulnerability in the Veritas Backup Exec Agent. It allows an attacker to execute arbitrary commands on the Backup Exec Agent machine by leveraging a data management protocol command. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. The vulnerability is rated as high severity due to its potential impact on system control.

CVE-2019-1388 is a privilege escalation vulnerability in the Microsoft Windows Certificate Dialog that allows attackers to execute processes with elevated privileges. It has been exploited in the wild and is known to have been used in ransomware campaigns. The vulnerability affects Microsoft Windows but specific affected versions are not provided. The severity is assessed as high due to the potential impact of privilege escalation.

CVE-2022-27926 is a high-severity cross-site scripting (XSS) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). The vulnerability arises because an endpoint URL accepts parameters without proper sanitization, allowing malicious scripts to be injected. This flaw has been exploited in the wild. No specific affected versions or patch information is provided.

Microsoft Internet Explorer has a memory corruption vulnerability (CVE-2013-3163) that can be exploited by remote attackers through crafted websites to execute arbitrary code or cause a denial of service. This vulnerability has been observed in the wild and is considered high severity.

CVE-2017-7494 is a remote code execution vulnerability in Samba that allows a malicious client to upload a shared library to a writable share and trigger the server to load and execute it. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. It poses a high risk due to the ability to execute arbitrary code remotely on affected systems.

CVE-2022-42948 is a high-severity remote code execution vulnerability in the Fortra Cobalt Strike User Interface. The flaw is rooted in Java Swing components and allows remote attackers to execute arbitrary code. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2022-39197 is a high-severity cross-site scripting (XSS) vulnerability in Fortra Cobalt Strike's Teamserver component. It allows an attacker to set a malformed username in the Beacon configuration, enabling remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

CVE-2021-30900 is an out-of-bounds write vulnerability in Apple GPU drivers affecting iOS, iPadOS, and macOS. This flaw may allow a malicious application to execute code with kernel privileges. The vulnerability has been exploited in the wild. Vendor advisories linked are unavailable, and no patch information is confirmed from the provided data.

CVE-2022-38181 is a use-after-free vulnerability in the Arm Mali GPU Kernel Driver. This flaw may allow a non-privileged user to gain root privileges or disclose sensitive information. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-3038 is a use-after-free vulnerability in the Google Chromium Network Service that allows remote attackers to potentially cause heap corruption by crafting a malicious HTML page. This vulnerability affects multiple Chromium-based web browsers such as Google Chrome, Microsoft Edge, and Opera. It has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-22706 is a high-severity vulnerability in the Arm Mali GPU Kernel Driver that allows a non-privileged user to gain write access to read-only memory pages. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.

CVE-2022-41328 is a path traversal vulnerability in Fortinet FortiOS that allows a local privileged attacker to read and write arbitrary files using crafted CLI commands. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

CVE-2021-39144 is a remote code execution vulnerability in XStream that allows attackers to manipulate input streams to inject or replace objects, leading to execution of local commands on the server. This flaw affects multiple products, including VMware Cloud Foundation. It has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

CVE-2020-5741 is a remote code execution vulnerability in Plex Media Server. It allows an attacker who has access to the server administrator's Plex account to upload a malicious file through the Camera Upload feature, which the media server then executes. This vulnerability has been exploited in the wild.

CVE-2022-28810 is a high-severity vulnerability in Zoho ManageEngine ADSelfService Plus that allows remote code execution during password change or reset operations. The vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.

Apache Spark contains a command injection vulnerability in its User Interface (UI) when Access Control Lists (ACLs) are enabled. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided in the available data.

Teclib GLPI contains a remote code execution vulnerability due to a flaw in the third-party library htmlawed. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.

CVE-2022-36537 is a high-severity vulnerability in the ZK Framework AuUploader servlets that allows an attacker to retrieve the content of files located within the web context. This unspecified vulnerability affects multiple products using the ZK Framework, including ConnectWise R1Soft Server Backup Manager. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.

IBM Aspera Faspex contains a high-severity vulnerability (CVE-2022-47986) due to a YAML deserialization flaw that allows remote code execution. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information are provided in the available data.